Depth locked at add-site
Pick Standard, Deep, or Agency Standard when you add the site. Daily pulse is the same on every seat. Quick and Comprehensive stay on credits or Scheduled Scans.
Website Watch
Know when your website security changes
Daily checks plus a weekly vulnerability scan. Alerts when something new appears. Standard is $29 per site. Agency Standard is $23 per site and starts at five sites.
Coverage
What is included
Daily pulse on every seat. Weekly Standard, Deep, or Agency Standard, locked at checkout. Credits are not charged for included runs.
Daily pulse
TLS, headers, mixed content, HTTP to HTTPS, and exposed paths. Not a ZAP-backed scan.
Weekly scan
Standard or Deep, locked when you add the site. Standard adds injection. Deep adds API, email, and DNS.
Delta alert
Email on new or worse findings, score drop, or cert windows. Mute from the watch page.
One seat per site
Standard
$29 / month
$290 / year. Weekly Standard scan. One site per checkout.
Deep
$49 / month
$490 / year. Weekly Deep scan. One site per checkout.
Agency Standard
$23 / site
First checkout is 5 sites: $115 / month or $1,150 / year. Each later site adds one seat after you confirm the prorated charge.
Pause keeps the paid seat. Cancel drops it at period end. Agency Standard stays at five seats or more while that subscription is active. Unused seats only attach to a new origin of the same depth. From an agency site you can save a standing client page, copy the link, or email it. Anyone with that link can read the latest weekly report until the site is canceled.
See pricing · Scheduled Scans stay on credits for custom cadence.
After a scan
Keep the origin in view
A dashboard scan is a snapshot. Watch is the daily pulse and weekly Standard or Deep that follows.
After you finish a scan, add the same HTTPS origin to Watch when you want change alerts instead of another one-off credit run. Daily pulse plus weekly Standard or Deep. Included runs do not use credits.
How to
How to set up Watch
Add one HTTPS origin per seat. Pick Standard, Deep, or Agency Standard. Checkout opens when you need another seat of that depth.
Open Watch
Sign in and go to /watch. The Watch item sits next to Scheduled. The dashboard card shows how many sites you are watching versus paid seats.
Add an HTTPS origin
Enter a name such as Shop production, the HTTPS URL, monthly or yearly billing, and Standard, Deep, or Agency Standard. Click Watch website. Unused paid seats attach only when they match that depth. Agency Standard starts at five seats.
Let the baseline finish
The first pulse and first weekly Standard or Deep scan record what already exists. You should not expect an inbox full of historical findings on day one. Open the watch to see last pulse, last weekly scan, and certificate days.
Tune alerts, then mute noise
Set new findings, resolved findings, score drop, minimum severity, quiet hours, timezone, extra recipients, and weekly digest. Mute accepted risk. Click Unmute on that row or under Muted issues when you want alerts again.
Expectations
What to expect
Watch answers whether the public origin changed. It is not a pentest and not a custom-depth scheduler.
Quiet first day is correct
Baseline runs do not spam existing findings. Alerts start when the site changes, the score drops, or a cert window is hit.
Manual runs are rate-limited
Run pulse now is once per 15 minutes. Run weekly Standard or Deep now is once per 6 hours. The included daily and weekly schedule still runs on its own.
Examples
Worked examples
How Watch looks for agencies, certificate expiry, and accepted staging risk.
Agency watching five shops
Choose Agency Standard and add the first HTTPS origin. Stripe quantity is five. The seat line shows Using 1 of 5. The other four seats stay open until you add origins. A Deep origin is a separate $49 seat.
Certificate 12 days from expiry
A pulse records the tightest window, 14 days, then later 7 days, then expired. Quiet hours can delay the mail until morning in the watch timezone.
Mute staging HSTS, then unmute
Staging is missing HSTS on purpose. Mute it. The row shows a Muted pill and Unmute. Production still alerts. When staging should be strict, click Unmute.
Compare
Watch versus Scheduled Scans versus pentest
Pick the product that matches the question you need answered.
| Product | Cadence | Billing | Credits | Best for |
|---|---|---|---|---|
| Website Watch | Daily pulse + weekly Standard, Deep, or Agency Standard | Standard $29 / Deep $49 / Agency Standard $23 per site / month | Included runs use none | Know when the public origin changed |
| Scheduled Scans | Custom calendar and depth | Plan or credits | Yes | Repeat Comprehensive or a custom weekday |
| Penetration Test | One engagement plus retests | $297 or $497 | Separate product | Verified automated evidence-backed testing |
Alerts
How to mute and unmute
Silence one accepted finding without turning Watch off.
Open the watch
Go to /watch, click the site, and find the finding under Open issues.
Mute accepted risk
Click Mute. The row shows a Muted pill and is listed under Muted issues. Later pulses still see the issue, but that fingerprint drops out of new-finding email.
Unmute when you want alerts again
Click Unmute on the same open-issue row, or in Muted issues. Alerts for that fingerprint resume on later change detection. You do not need support to clear a mute. Do not turn off New findings globally to hide one staging quirk.
Step-by-step setup, troubleshooting, and more examples live in Website Watch documentation and Website Watch help.
FAQ
Website Watch FAQ
Billing, credits, mute, and how Watch differs from Scheduled Scans and pentest.
Watch is always-on monitoring for one HTTPS origin. Vulnify runs a daily pulse (headers, certificate expiry, exposed paths) and one weekly Standard or Deep scan, chosen when you add the site. You get an email when something new appears.
Start watching an origin
Add an HTTPS site, pay per seat, and get mail when the public surface changes.